Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\{4aa7ec97-2a2c-4ccd-980f-071d4e7f19a8}
Creates the following services
- [<HKLM>\System\CurrentControlSet\Services\NativeDesktopMediaService] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\NativeDesktopMediaService] 'ImagePath' = '"%ProgramFiles%\Jetmedia\NativeDesktopMediaService\desktop_media_service.exe" --service'
Malicious functions
To bypass firewall, removes or modifies the following registry keys
- [<HKLM>\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] 'DoNotAllowExceptions' = '00000000'
Modifies file system
Creates the following files
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\decoder.dll
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\networkdesktopmedia.msi
- %TEMP%\msia4be.tmp
- %TEMP%\msia9d5.tmp
- %TEMP%\2d06c35019e2c419e474.msiaf1d.tmp
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\desktop_media_service.exe
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\watchdog.exe
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\commonappdatafolder\jetmedia\nativedesktopmediaservice\comdata.dat
- %ProgramFiles%\jetmedia\nativedesktopmediaservice\desktop_media_service.exe
- %ProgramFiles%\jetmedia\nativedesktopmediaservice\watchdog.exe
- %PROGRAMDATA%\jetmedia\nativedesktopmediaservice\comdata.dat
Deletes the following files
- %TEMP%\msia4be.tmp
- %TEMP%\msia9d5.tmp
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\decoder.dll
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\commonappdatafolder\jetmedia\nativedesktopmediaservice\comdata.dat
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\desktop_media_service.exe
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\networkdesktopmedia.msi
- %APPDATA%\jetmedia\nativedesktopmediaservice 3.6.0\install\2cf5f20\watchdog.exe
Network activity
TCP
HTTP GET requests
- http://ip###i.com:80/json
- http://xf###nst.com/npcomdata.dat
HTTP POST requests
- http://tm#.####tincoandhar.info/
- http://mr##wic.com/tickets
- http://ss#.####tincoandhar.info/
- http://mr####c.com:40000/tickets
- http://xt###est.com/tickets
- http://yl##est.com/tickets
- http://in##.###ntincoandhar.info/
- http://sc#.####tincoandhar.info/
UDP
- DNS ASK tm#.####tincoandhar.info
- DNS ASK mr##wic.com
- DNS ASK in##.###ntincoandhar.info
- DNS ASK ip##pi.com
- DNS ASK ex##ple.com
- DNS ASK sc#.####tincoandhar.info
- DNS ASK ss#.####tincoandhar.info
- DNS ASK xt###est.com
- DNS ASK xf###nst.com
- DNS ASK yl##est.com
Miscellaneous
Creates and executes the following
- '%WINDIR%\installer\msiaf1d.tmp' /p="<Full path to file>" /p="%APPDATA%\Jetmedia\NativeDesktopMediaService 3.6.0\install\2CF5F20\NetworkDesktopMedia.msi" /p="%ProgramFiles%\Jetmedia\NativeDesktopMediaService" /p="" /p=""
- '%TEMP%\2d06c35019e2c419e474.msiaf1d.tmp' $$xfDT-ViyxlqCdQlfZRvVJblqb1yLTWpSTg0XCTfbMo6usOAZ1nyqC-WlI2ZIMxnK0HdJhP42wHQetdPTs7r2GvIXQR4IHziABvGUuUAf_Y5GKCHJH6bBBcIU9yhYgwbUiHevnz88dbhhO6sx0LAqXpgqL8YossPuIH2scSFn7JBtCV2Os73fo7Njpaemg0g...
- '%ProgramFiles%\jetmedia\nativedesktopmediaservice\desktop_media_service.exe' --service
Executes the following
- '<SYSTEM32>\msiexec.exe' /V
- '<SYSTEM32>\msiexec.exe' -Embedding 0E6E33C7158CC42286201CD5D481C163 C
- '<SYSTEM32>\msiexec.exe' /i "%APPDATA%\Jetmedia\NativeDesktopMediaService 3.6.0\install\2CF5F20\NetworkDesktopMedia.msi" AI_SETUPEXEPATH=<Full path to file> SETUPEXEDIR=<Current directory>\ EXE_CMD_LINE="/exenoupdates ...
- '<SYSTEM32>\msiexec.exe' -Embedding B64ACE31DC290093D0F51DFCDFB1DF03
- '<SYSTEM32>\msiexec.exe' -Embedding DD91F3212756C8DF23B6BA2E8681711B M Global\MSI0000
